Subject: Re: [keyassure] Charter discussion - Use of DNSSEC in applications

From: "Jeffrey A. Williams" <[email-masked]>
Date: Thu, 19 Aug 2010 15:58:40 -0500 (GMT-05:00)

David and all,

  The choices for whom to trust are:  Verisign, ICANN, or the
USG.  Well that's a poor group to pick from according to 
many folks, eh Dave? >;)  As most americans know the trust
in their government is at a nearly 70 year low, Trust in ICANN
has ebbed and flowed but is nearly as low, and Verisign all
be they have good folks there, seems to be the default remaining
choice.  Seems like a logical deduction choice that leaves 
in some folks mind and experiance, not very good choices.

  We need more choices OR we need better choices, take your
pick.  The 'Truste Anchors' approach in DNSSEC gives a few
more, but perhaps not enough OR not the 'Right' ones to choose
from?

-----Original Message-----
>From: David Conrad <[email-masked]>
>Sent: Aug 18, 2010 10:42 PM
>To: Phillip Hallam-Baker <[email-masked]>
>Cc: [email-masked]
>Subject: Re: [keyassure] Charter discussion - Use of DNSSEC in applications
>
>On Aug 18, 2010, at 7:26 PM, Phillip Hallam-Baker wrote:
>> I want to use dnssec without the ICANN root. 
>
>Feel free.  There are (currently) only about 300 TLD trust anchors you'll have to keep track of if all the TLDs started signing. ICANN says they'll be adding no more than about 1000/year. You'll have to figure out a way of securely fetching the trust anchors from the TLD admins who sign their zones to install into your validating resolver, but that's a minor detail.
>
>A single root of trust _can be_ better since there are less parties to vet and audit (1 versus many).  However, as I said, if you don't want to trust ICANN, VeriSign, and the US Government, you don't have to.
>
>Regards,
>-drc
>
>_______________________________________________
>keyassure mailing list
>[email-masked]
>https://www.ietf.org/mailman/listinfo/keyassure

Regards,

Jeffrey A. Williams
Spokesman for INEGroup LLA. - (Over 300k members/stakeholders and growing, strong!)
"Obedience of the law is the greatest freedom" -
   Abraham Lincoln

"Credit should go with the performance of duty and not with what is very
often the accident of glory" - Theodore Roosevelt

"If the probability be called P; the injury, L; and the burden, B; liability
depends upon whether B is less than L multiplied by
P: i.e., whether B is less than PL."
United States v. Carroll Towing  (159 F.2d 169 [2d Cir. 1947]
===============================================================
Updated 1/26/04
CSO/DIR. Internet Network Eng. SR. Eng. Network data security IDNS. div. of
Information Network Eng.  INEG. INC.
ABA member in good standing member ID 01257402 E-Mail [email-masked]
Phone: 214-244-4827

---

From: Ondřej Surý <[email-masked]>
Date: Fri, 20 Aug 2010 10:24:24 +0200

[moderator hat on]
This is really off-topic.  Please cease a discussion on who to trust. 
This group is to get work done and not to discuss irrelevant topics like 
this.  Don't clutter the mailing list, thanks.
[/moderator hat off]

On 19.8.2010 22:58, Jeffrey A. Williams wrote:
> many folks, eh Dave?>;)  As most americans know the trust
>> From: David Conrad<[email-masked]>
>> To: Phillip Hallam-Baker<[email-masked]>
>> Cc: [email-masked]

-- 
  Ondřej Surý
  vedoucí výzkumu/Head of R&D department
  -------------------------------------------
  CZ.NIC, z.s.p.o.    --    Laboratoře CZ.NIC
  Americka 23, 120 00 Praha 2, Czech Republic
  mailto:[email-masked]    http://nic.cz/
  tel:+420.222745110       fax:+420.222745112
  -------------------------------------------

---

From: Ondřej Surý <[email-masked]>
Date: Fri, 20 Aug 2010 15:58:06 +0200

On 20.8.2010 13:49, Phillip Hallam-Baker wrote:
> Seems to me that you are making statements and then ruling objections
> to those statements as off topic.

You are ripping my words out of the context.  I am saying that this is 
no place to discuss whether we trust "ICANN, Verisign or USG".  This 
group has the proposed charter based on fact that we are going to use 
DNS and DNSSEC, and we trust it.

Again this should be a place where the work is done, and not a chitchat 
list for discussing whether US companies are good or not.  And I ask all 
participants to respect that.

> - Show quoted text -
> Exactly.  The change of the trust model will be always scary.  But it
> is important to realize that we don't change overall level of security
> (in fact, we are improving it), just the trust model.
>
>
> Ondrej
>
> On Fri, Aug 20, 2010 at 4:24 AM, Ondřej Surý<[email-masked]>  wrote:
>> [moderator hat on]
>> This is really off-topic.  Please cease a discussion on who to trust. This
>> group is to get work done and not to discuss irrelevant topics like this.
>>   Don't clutter the mailing list, thanks.
>> [/moderator hat off]

---

From: Phillip Hallam-Baker <[email-masked]>
Date: Fri, 20 Aug 2010 12:52:05 -0400

That was a private, offlist email that you have now chosen to share
with the whole list.

While I probably should have remembered to flag it as [offlist], it is
generally proper to take care not to do this sort of thing.

Again, if you propose a technical infrastructure that has a dependency
on one particular party, then the behavior of that party becomes
relevant in the technical discussion.

If you wish to avoid that you must design an architecture that removes
the dependency.

from	Phillip Hallam-Baker <[email-masked]>
to	Ondřej Surý <[email-masked]>
date	Fri, Aug 20, 2010 at 7:49 AM
subject	Re: [keyassure] Charter discussion - Use of DNSSEC in applications
mailed-by	gmail.com

On Fri, Aug 20, 2010 at 9:58 AM, Ondřej Surý <[email-masked]> wrote:
> You are ripping my words out of the context.  I am saying that this is no
> place to discuss whether we trust "ICANN, Verisign or USG".  This group has
> the proposed charter based on fact that we are going to use DNS and DNSSEC,
> and we trust it.
>
> Again this should be a place where the work is done, and not a chitchat list
> for discussing whether US companies are good or not.  And I ask all
>>> This

-- 
Website: http://hallambaker.com/